promptfoo-code-scan.yml

name: Promptfoo Code Scan

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Run Promptfoo Code Scan
        uses: promptfoo/code-scan-action@v0
        with:
          min-severity: medium
          guidance: |
            - Always comment on a block of code—never just a single line. And always make sure the start line comes before the end line.

  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [security-scan]
    if: always()
    timeout-minutes: 5
    permissions:
      checks: read
      statuses: read

    steps:
      - name: Wait for all PR checks to succeed
        uses: promptfoo/.github/.github/actions/ci-success@main
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          timeout-seconds: 300